Falhas do tipo CWE-532

939 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2024-28186HIGHSMTP Mail Credentials Disclosed in Error Log in freescoutEPSS 0.6%CVE-2025-62209MEDIUMWindows License Manager Information Disclosure VulnerabilityEPSS 0.6%CVE-2025-62208MEDIUMWindows License Manager Information Disclosure VulnerabilityEPSS 0.6%CVE-2024-33637HIGHWordPress Solid Affiliate plugin <= 1.9.1 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.6%CVE-2022-49037MEDIUMInsertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allowEPSS 0.5%CVE-2024-32788MEDIUMWordPress FG Joomla to Wordpress plugin <= 4.20.2 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.5%CVE-2020-5262HIGHGitHub personal access token leaking into temporary EasyBuild (debug) logsEPSS 0.5%CVE-2023-20885MEDIUMCF workflows leak credentials in system audit logsEPSS 0.5%CVE-2023-32478CRITICAL Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability. A high privileged maliEPSS 0.5%CVE-2020-8563MEDIUMSecret leaks in logs for vSphere Provider kube-controller-managerEPSS 0.5%CVE-2021-3039LOWPrisma Cloud Compute: User role authorization secret for Console leaked through log file exportEPSS 0.5%CVE-2025-24556HIGHWordPress MooWoodle plugin <= 3.2.4 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2018-16889MEDIUMCeph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in lEPSS 0.5%CVE-2018-16859MEDIUMExecution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' paEPSS 0.5%CVE-2026-110248MEDIUMInsertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]pyEPSS 0.5%CVE-2025-20231HIGHSensitive Information Disclosure in Splunk Secure Gateway AppEPSS 0.5%CVE-2021-22133—The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an applicatioEPSS 0.5%CVE-2023-38732MEDIUMIBM Robotic Process Automation information disclosureEPSS 0.5%CVE-2020-8566MEDIUMCeph RBD adminSecrets exposed in logs when loglevel >= 4EPSS 0.5%CVE-2024-31245MEDIUMWordPress ConvertKit plugin <= 2.4.5 - Email Disclosure in Log File vulnerabilityEPSS 0.5%